Maintaining Up-to-Date Contact Information for Security Incidents

Written with contributions from Bryon Singh, Director of Security Operations, RailWorks Corporation

In the world of cybersecurity, a swift and coordinated response to security incidents is crucial. Central to this response is having up-to-date contact information for all parties that need to be informed. From internal staff to third-party vendors, law enforcement, and beyond, knowing whom to contact and how to reach them can make a significant difference in mitigating the impact of a security breach. This blog post explores the importance of establishing and maintaining contact information for security incidents, using engaging references from popular culture to illustrate these concepts.

The Importance of Contact Information in Incident Response

Imagine the intricate network of communications in "The Avengers." When a threat arises, Nick Fury has to contact the right heroes, allies, and government agencies quickly and efficiently. Similarly, in a cybersecurity incident, having accurate contact information for all relevant parties is essential for a swift and effective response.

Key Contacts for Security Incidents

1. Internal Staff: Just as the crew of the starship Enterprise in "Star Trek" needs to coordinate among various departments during a crisis, your organization must have contact information for key internal personnel. This includes IT staff, incident response team members, and executive leadership.
2. Third-Party Vendors: In "The Matrix," Neo and his team rely on external allies to fight their battles. Similarly, your organization may depend on third-party vendors for services such as cloud hosting, cybersecurity solutions, and technical support. Ensure you have up-to-date contact information for these vendors.
3. Law Enforcement: In "Batman," Commissioner Gordon relies on the Bat-Signal to summon Batman in times of crisis. Your organization should have direct contact information for local law enforcement agencies to report criminal activities swiftly.
4. Cyber Insurance Providers: Just as Harry Potter turns to Dumbledore for guidance, your organization should know how to reach its cyber insurance provider to report incidents and seek assistance in handling claims and recovery.
5. Relevant Government Agencies: In "Men in Black," agents report to a central government agency to handle extraterrestrial threats. Similarly, certain cybersecurity incidents may need to be reported to government bodies like the Cybersecurity and Infrastructure Security Agency (CISA) or other regulatory entities.
6. Information Sharing and Analysis Center (ISAC) Partners: Just as members of the Fellowship in "The Lord of the Rings" share information and resources, your organization should be part of an ISAC. Maintain contact information for ISAC partners to share threat intelligence and receive support.
7. Other Stakeholders: This could include business partners, customers, and other entities impacted by the security incident. Maintaining open lines of communication with these stakeholders is crucial for transparency and trust.

Verifying Contact Information

In "Jurassic Park," constant communication is critical to managing the park's safety systems. Similarly, regularly verifying contact information ensures that you can reach the right people when it matters most. Here are some best practices:

1. Annual Verification: Conduct an annual review of all contact information. This involves reaching out to each contact to confirm their details are still accurate and up-to-date.
2. Significant Changes: Update contact information whenever there are significant changes within your organization, such as mergers, acquisitions, or restructuring.
3. Testing Communication Channels: Periodically test communication channels to ensure they are functional. This could include sending test messages or making calls to verify that contacts are reachable.
4. Documentation and Accessibility: Maintain documented contact information in a secure but easily accessible location. Ensure that all relevant personnel know where to find this information during an incident.

Practical Steps for Implementation

1. Centralized Contact List: Maintain a centralized contact list that includes all necessary parties. This list should be accessible to all members of the incident response team.
2. Clear Guidelines: Establish clear guidelines for updating and verifying contact information. Ensure these guidelines are well-documented and communicated to all relevant personnel.
3. Training: Conduct regular training sessions to ensure that employees understand the importance of maintaining up-to-date contact information and know how to access and use the contact list during an incident.
4. Regular Updates: Schedule regular updates and reviews of the contact list, especially after any organizational changes or significant incidents.

Establishing and maintaining up-to-date contact information for all parties involved in security incidents is a vital component of an effective incident response plan. Drawing parallels to popular culture can help make these concepts more engaging and relatable for your workforce. By ensuring that contact information is accurate and readily available, your organization can respond swiftly and effectively to any security incident, minimizing its impact and facilitating a quicker recovery.

Start your verification process today and empower your incident response team with the information they need to protect your organization.

Here’s a link to the Incident Response Policy Template provided free of charge from the fine folks at the Center for Internet Security: https://www.cisecurity.org/insights/white-papers/incident-response-policy-template-for-cis-control-17

Here’s some detail on this specific Control/Safeguard. If you want more detail, DM me.

CIS Control 17 – Incident Response Management

Establish a program to develop and maintain an incident response capability (e.g., policies, plans, procedures, defined roles, training, and communications) to prepare, detect, and quickly respond to an attack.

Implementation Group 1

CIS Safeguard 17.2 - Establish and Maintain Contact Information for Reporting Security Incidents

Establish and maintain contact information for parties that need to be informed of security incidents. Contacts may include internal staff, third-party vendors, law enforcement, cyber insurance providers, relevant government agencies, Information Sharing and Analysis Center (ISAC) partners, or other stakeholders. Verify contacts annually to ensure that information is up-to-date.